How I get in.
One small server in a Melbourne house, and the trip a single request takes to reach it. Scroll to send it.
01My phone
Wrapped before it leaves
I'm out, on mobile data, with Tailscale switched on. Before the request goes anywhere it's sealed inside WireGuard, so nobody between here and home can read it.
02Tailscale
Straight home, encrypted
The tunnel runs from my phone to the server, directly when it can and through a relay when it can't. Cloudflare sits off to the side: it holds the domain's DNS and proved the certificate is mine, but it never sees this request.
03AdGuard Home
An address only I can use
The name lookup is answered at home, through the tunnel, with a private address. Ask the internet for the same name and you get somewhere that leads nowhere.
04Caddy
The front door
One wildcard certificate covers every app. Caddy reads which one I asked for and sends the request on, but not before it checks in with the gate.
05Authelia
Two keys, every time
A password and a second factor. Nothing gets past without both, and one sign-in then covers every app behind the door.
06Docker
Delivered
About sixty containers, each with one job. The request drops into the one I asked for, and the answer goes back the way it came.
07Inside the box
Take it apart
Network, front door, apps, cameras and backups: one small PC doing five jobs. Pick a layer to see what's in it.
08Your way in
You never reached my house
This page came from Cloudflare's data centre nearest you, served by a Worker from files built out of a private repo. There's no route from here to my server, and that's on purpose.
I'm Adrian.
I'd rather own the things I depend on, so my passwords, documents, cameras, media and mail run on that one box, reachable only from my own devices. Every setting lives in git, every failure gets written up with its fix, and anything that breaks pings my phone.